Thread by @nav1n0x

You guys always ask me how do I find SQL injections, its just simple. Avoid what everyone does and make your own methodology. Here is mine:

1. I don't normally go if the target is just target.com. I always prefer the target with wide scope.

1/n
#BugBounty

2. I always prefer to avoid main domain & focus on subdomain instead. Main domain is targeted by hundreds already, So go deeper, if you go deeper its more dark there & you will see its less crowded.

3. Make your own word-list using CeWL or anything

#bugbountytips

2/n

4. Use your word list to find hidden parameters. Read this well written article by @KathanP19 medium.com/geekculture/pa…

5. Use your word list to find hidden subdomains, I found 10s of more subdomains using WL created using the common words used in the source.
3/n

6. Code Review: This should your approach for everything. The JavaScript or a simple source-code review will make you understand how the application works. This will as well help you to find more and more hidden parameters.

Read: hackerone.com/vulnerability-…
4/n

7. Use SQLMAP and Ghauri by @r0oth3x49 extensively. In a lot of cases I found Ghauri was faster than SQLMAP with less false-positives. Make sure to try different techniques, bypass scripts. Do not forget to watch @GodfatherOrwa methodology here: youtube.com/playlist?list=…

5/n

Read this list, there are lot of HackerOne reports listed specially SQL injection related. Read 2-3 articles per day and understand the methodology used by others and create your own based on it.

github.com/reddelexc/hack…

6/n

And lastly, make your own methodology. My methodology works works for me, it may not work for you. I spent months reading, trying different ways and failing multiple times b4 getting here, so don't expect the results next day. Practice and make yourself perfect.
Goodluck.

7/n